请看看这个

龙井茶

下游戏本来240M的,结果下了这么200多K的东西,红伞C扫描没发现东西.请各位试一下.

hahacomcn

P版报的，，

C:\Documents and Settings\Administrator\桌面\setup.rar
  [0] Archive type: RAR
  --> setup.exe
      [DETECTION] Contains suspicious code HEUR/Crypted

观弈书童

setup.exe - 未查明的 NewHeur_PE 病毒 [7]

laperte

时间 进程名 路径及参数 源IP 源端口 目的IP 目的端口 操作
2007-10-16 10:11:33 SETUP.EXE C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETUP\SETUP.EXE 0.0.0.0 2315 211.152.45.198 80 阻断
2007-10-16 10:11:32 SETUP.EXE C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETUP\SETUP.EXE 0.0.0.0 2313 218.64.182.109 80 阻断
2007-10-16 10:10:53 SETUP.EXE C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETUP\SETUP.EXE 0.0.0.0 2292 211.152.45.198 80 阻断
2007-10-16 10:10:52 SETUP.EXE C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\SETUP\SETUP.EXE 0.0.0.0 2279 218.64.182.109 80 永远禁止

龙井茶

P和C就这么大差别啊?看来还是P稳当些.

mofunzone

真正里面有问题的东西，我把广告也上报了

File:	MSDOS.COM
Status:	INFECTED/MALWARE
MD5:	96223e34401f46198f0b41a1277180bc
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 16 Oct 2007 02:46:26 (GMT)
A-Squared	Found nothing
AntiVir	Found TR/Crypt.NSPM.Gen
ArcaVir	Found nothing
Avast	Found Win32:Virtualizer
AVG Antivirus	Found Worm/Generic.DWU
BitDefender	Found Worm.Autorun.Delf.A
ClamAV	Found nothing
CPsecure	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found Virus.Win32.AutoRun.uu
Fortinet	Found nothing
Kaspersky Anti-Virus	Found Virus.Win32.AutoRun.uu
NOD32	Found probably a variant of Win32/AutoRun.Q (probable variant)
Norman Virus Control	Found Hupigon.gen66
Panda Antivirus	Found Generic
Rising Antivirus	Found nothing
Sophos Antivirus	Found Mal/EncPk-AI
VirusBuster	Found nothing
VBA32	Found Embedded.MalwareScope.Trojan-PSW.Game.7 (probable variant)

wangjay1980

detected: Trojan program Trojan-Spy.Win32.Delf.anl        URL: http://bbs.kafan.cn/attachment.php?aid=140084//setup.exe

xxh21cn

微点：
C:\DOCUMENTS AND SETTINGS\HUA\LOCAL SETTINGS\TEMP\RAR$EX00.742\SETUP.EXE
木马程序生成以下文件：
1) C:\DOCUMENTS AND SETTINGS\HUA\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\IBSJIPIL\JXJ[1].CSS
2) C:\WINDOWS\MSDOS.COM
3) C:\PROGRAM FILES\COMMON FILES\SYSTEM\WINSYS64.SYS
是否删除木马程序及其衍生物

timhas266

Start of the scan: Tuesday, 16 October, 2007  17:32

Starting the file scan:

Begin scan in 'C:\Documents and Settings\tim\桌面\setup.rar'
C:\Documents and Settings\tim\桌面\setup.rar
  [0] Archive type: RAR
  --> setup.exe
      [DETECTION] Contains suspicious code HEUR/Crypted
      [INFO]      A backup was created as '478885aa.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!


End of the scan: Tuesday, 16 October, 2007  17:32
Used time: 00:01 min

The scan has been done completely.

      0 Scanning directories
      2 Files were scanned
      0 viruses and/or unwanted programs were found
      1 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      0 Notes

运指如飞

大蜘蛛没有报

但是运行后直接要求访问网络